🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2db625b333c2d5b5d982c815d16dbbd6a8e9f1413da63a7fbbded9357b76a335. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XWorm


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2db625b333c2d5b5d982c815d16dbbd6a8e9f1413da63a7fbbded9357b76a335
SHA3-384 hash: d8108b0a500ba2946e313b7cf1b8f65d630cc5e906d6afe4179255b00ef03c72f1fa0352492949db1e0400d63e844596
SHA1 hash: e82cb425a1ad7a7bd8b08b81137512da5b6beb0a
MD5 hash: 71a9dc5447b988287538088f971eefb3
humanhash: nineteen-grey-dakota-batman
File name:Orden de compra-IMG.js
Download: download sample
Signature XWorm
Create hunting rule
File size:440'145 bytes
First seen:2026-10-09 14:57:59 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 12288:URdJIs4ZqpG62LGQAxvaBSMgBqt3G7zN2Peqd8b9C:/D362LMxvIgBqEN29/
TLSH T16194CF94E122D4823B3D27621B1B1F4051B1C1B19F8A9DCDD19CD3F66E9A6AACBFCC44
Magika batch
Reporter abuse_ch
Tags:js xworm

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.GT.JS.Agent.1320.82060AEF.21745317.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
attrib evasive obfuscated powershell repaired
Link:
https://www.filescan.io/uploads/6ac9010a03d112694f1209bf/reports/36bdf5b7-9891-4c6a-9b97-07983cb8fd2c/overview
Verdict:
Malicious
Labled as:
GT:JS.Agent.1320
Link:
https://www.hybrid-analysis.com/sample/2db625b333c2d5b5d982c815d16dbbd6a8e9f1413da63a7fbbded9357b76a335
Verdict:
Malicious
File Type:
js
First seen:
2026-10-09T10:49:00Z UTC
Last seen:
2026-10-11T12:52:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/2db625b333c2d5b5d982c815d16dbbd6a8e9f1413da63a7fbbded9357b76a335/results?tab=lookup
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1984923
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Hijacks the control flow in another process
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sample uses string decryption to hide its real strings
Sigma detected: Invoke-Obfuscation Via Stdin
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential WinAPI Calls Via CommandLine
Sigma detected: Powershell launch wmic via class
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses attrib.exe to hide files
Uses cmd line tools excessively to alter registry or file data
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1984923 Sample: Orden de compra-IMG.js Startdate: 09/10/2026 Architecture: WINDOWS Score: 100 115 keyauth.win 2->115 131 Sigma detected: Powershell launch wmic via class 2->131 133 Suricata IDS alerts for network traffic 2->133 135 Found malware configuration 2->135 137 15 other signatures 2->137 13 wscript.exe 1 1 2->13         started        16 conhost.exe 2->16         started        18 conhost.exe 2->18         started        20 4 other processes 2->20 signatures3 process4 signatures5 171 JScript performs obfuscated calls to suspicious functions 13->171 173 Wscript starts Powershell (via cmd or directly) 13->173 175 Windows Scripting host queries suspicious COM object (likely to drop second stage) 13->175 179 2 other signatures 13->179 22 cmd.exe 1 13->22         started        25 powershell.exe 8 13->25         started        28 cmd.exe 16->28         started        30 cmd.exe 18->30         started        177 Installs a global keyboard hook 20->177 32 cmd.exe 20->32         started        34 conhost.exe 20->34         started        36 conhost.exe 20->36         started        process6 file7 139 Suspicious powershell command line found 22->139 141 Wscript starts Powershell (via cmd or directly) 22->141 143 Uses cmd line tools excessively to alter registry or file data 22->143 145 Uses attrib.exe to hide files 22->145 38 powershell.exe 22->38         started        40 conhost.exe 22->40         started        43 powershell.exe 15 22->43         started        45 attrib.exe 22->45         started        105 C:\Users\user\AppData\...\138238353046209.cmd, ASCII 25->105 dropped 147 Found suspicious powershell code related to unpacking or dynamic code loading 25->147 47 conhost.exe 25->47         started        49 powershell.exe 28->49         started        51 3 other processes 28->51 53 3 other processes 30->53 55 3 other processes 32->55 149 Installs a global keyboard hook 34->149 signatures8 process9 signatures10 57 powershell.exe 1 46 38->57         started        151 Installs a global keyboard hook 40->151 61 cmd.exe 49->61         started        process11 file12 107 C:\Users\user\...\nls_cache_XENRSMQCh.cmd, DOS 57->107 dropped 109 C:\Users\user\...\nls_cache_SNLXBPAU.cmd, ASCII 57->109 dropped 111 C:\Users\user\AppData\Local\...\nls_cache.dat, ASCII 57->111 dropped 153 Hijacks the control flow in another process 57->153 155 Creates multiple autostart registry keys 57->155 157 Creates an autostart registry key pointing to binary in C:\Windows 57->157 161 3 other signatures 57->161 63 choice.exe 57->63         started        68 conhost.exe 57->68         started        159 Wscript starts Powershell (via cmd or directly) 61->159 70 powershell.exe 61->70         started        72 conhost.exe 61->72         started        74 powershell.exe 61->74         started        signatures13 process14 dnsIp15 117 203.202.232.254, 1122, 49723, 49725 WHITELABELUS Turkey 63->117 103 C:\Users\user\AppData\...\XWormClient.exe, PE32+ 63->103 dropped 121 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 63->121 123 Tries to steal Mail credentials (via file / registry access) 63->123 125 Creates multiple autostart registry keys 63->125 129 2 other signatures 63->129 76 choice.exe 63->76         started        79 csc.exe 63->79         started        82 csc.exe 63->82         started        86 2 other processes 63->86 127 Installs a global keyboard hook 68->127 84 powershell.exe 70->84         started        file16 signatures17 process18 file19 163 Antivirus detection for dropped file 76->163 113 C:\Users\user\AppData\Local\Temp\choice.exe, PE32 79->113 dropped 88 conhost.exe 79->88         started        90 cvtres.exe 79->90         started        92 conhost.exe 82->92         started        94 cvtres.exe 82->94         started        165 Hijacks the control flow in another process 84->165 167 Writes to foreign memory regions 84->167 169 Maps a DLL or memory area into another process 84->169 96 conhost.exe 84->96         started        99 choice.exe 84->99         started        signatures20 process21 signatures22 119 Installs a global keyboard hook 96->119 101 conhost.exe 99->101         started        process23
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/2db625b333c2d5b5d982c815d16dbbd6a8e9f1413da63a7fbbded9357b76a335
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
PowerShell T1059.001
Link:
https://app.malva.re/file/71a9dc5447b988287538088f971eefb3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2db625b333c2d5b5d982c815d16dbbd6a8e9f1413da63a7fbbded9357b76a335/
Threat name:
Script-JS.Dropper.Powecod
Create hunting rule
Status:
Malicious
First seen:
2026-10-09 14:13:12 UTC
File Type:
Text (Batch)
AV detection:
12 of 38 (31.58%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fw3clmztylk3lwmczak5c3n322uot4kbhwtdu75333mtk63wum2q._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm defense_evasion discovery execution persistence privilege_escalation rat trojan
Link:
https://tria.ge/reports/261009-scaypsh16z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Enumerates video capture drivers
Hide Artifacts: Hidden Files and Directories
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Family: Xworm
Malware Config
C2 Extraction:
203.202.232.254:1122
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments